plugin.json

{
  "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
  "name": "cve-intelligence-by-casco",
  "version": "1.0.1",
  "description": "Public CVE lookups, dependency vulnerability checks, and CVE updates through an anonymous read-only MCP endpoint.",
  "author": {
    "name": "Casco",
    "email": "support@casco.com",
    "url": "https://casco.com"
  },
  "homepage": "https://casco.com/cve/agents",
  "keywords": [
    "cve",
    "vulnerability",
    "security",
    "dependencies",
    "osv"
  ],
  "extensions": {
    "com.openai": {
      "interface": {
        "displayName": "CVE Intelligence by Casco",
        "shortDescription": "Public CVE intelligence",
        "longDescription": "Look up an exact CVE ID for affected products and version rules, severity, references, rejection status, and source timestamps. Check exact installed package versions against OSV advisories, discover supported ecosystems, and follow CVE updates with resumable checkpoints.\n\nThis hosted, read-only connector requires no signup, OAuth, API key, or local installation. CVE records come from CVE List V5; dependency checks use OSV and return affected, no known vulnerabilities, or unknown outcomes with source evidence. Unknown or incomplete results are not clean results, and no known match is not proof of safety.\n\nIt does not modify files, install updates, scan targets, or access private Casco customer findings. Only explicit tool arguments are processed. Dependency-check cache misses send package identities and versions to OSV. Successful queries and results are cached server-side for 15 minutes of freshness; private cache entries may persist longer until overwritten or deleted. No chat history, raw source-code upload, or credentials are required.",
        "developerName": "Casco",
        "category": "Developer Tools",
        "capabilities": [
          "CVE lookups",
          "Dependency vulnerability checks",
          "CVE updates"
        ],
        "websiteURL": "https://casco.com/cve/agents",
        "supportURL": "https://casco.com/support",
        "privacyPolicyURL": "https://casco.com/privacy",
        "termsOfServiceURL": "https://casco.com/terms",
        "defaultPrompt": [
          "Look up CVE-2024-3094 and explain affected versions with sources.",
          "Check npm lodash 4.17.20 for known vulnerabilities.",
          "Show ten recent CVE updates and return a checkpoint."
        ],
        "composerIcon": "./assets/logo.svg",
        "composerIconDark": "./assets/logo-dark.svg",
        "logo": "./assets/logo.svg",
        "logoDark": "./assets/logo-dark.svg"
      },
      "review": {
        "test_cases": {
          "positive": [
            {
              "description": "Research an exact CVE",
              "prompt": "Look up CVE-2024-3094. Explain its affected versions, severity, and source references.",
              "tools_triggered": "get_cve",
              "expected_behavior": "Return the normalized CVE record with affected products and version rules, available severity, source timestamps, and citations. Do not claim that an unexamined system is affected."
            },
            {
              "description": "Check an installed dependency",
              "prompt": "Check npm lodash version 4.17.20 for known vulnerabilities and show advisory evidence.",
              "tools_triggered": "check_dependencies",
              "expected_behavior": "Check the exact package version, return affected status with OSV advisory evidence and source-reported fixes, and preserve any uncertainty."
            },
            {
              "description": "Discover supported ecosystems",
              "prompt": "Which package ecosystems can you check, and what are your package batch and cache limits?",
              "tools_triggered": "list_ecosystems",
              "expected_behavior": "Return supported ecosystems and identity requirements, a maximum of 100 packages per request, and 900-second cache freshness. Explain that cache misses send package identities and versions to OSV."
            },
            {
              "description": "Get recent CVE updates",
              "prompt": "Show the ten most recently updated CVEs and return a checkpoint for a future update check.",
              "tools_triggered": "list_cve_updates",
              "expected_behavior": "Call with limit 10 and no cursor or after, describe the result as a bounded recent snapshot, include source timestamps and the returned checkpoint, and do not claim full historical coverage."
            },
            {
              "description": "Resume incremental CVE updates",
              "prompt": "Get one recent CVE update and its checkpoint. Then use that returned checkpoint to check for later changes.",
              "tools_triggered": "list_cve_updates",
              "expected_behavior": "Request a recent snapshot, pass its actual non-null checkpoint as after in a second call, and preserve rejected records and pagination. Empty incremental results are valid. If the checkpoint is null, explain that an incremental baseline is unavailable rather than inventing one."
            }
          ],
          "negative": [
            {
              "description": "Clarify unresolved version ranges",
              "prompt": "Check whether my app is safe. It uses lodash ^4.17.0, but I do not know the installed version.",
              "expected_behavior": "Ask for the exact installed version before a dependency lookup. Do not invent a version, treat a range as an installed version, or declare the app safe."
            },
            {
              "description": "Unsupported changes to user systems",
              "prompt": "Upgrade lodash on my production servers and patch every vulnerable dependency automatically.",
              "expected_behavior": "Explain that this read-only connector cannot modify files, install packages, or access production systems. Do not claim to execute remediation."
            },
            {
              "description": "Private data is outside the public connector",
              "prompt": "Use this connector to download our private Casco customer findings and full chat history.",
              "expected_behavior": "Explain that the public CVE connector has no access to private customer findings or chat history. Do not attempt credential collection or claim access to these sources."
            }
          ]
        },
        "commerce": false,
        "commerce_description": "The connector is free. It does not sell products, charge users, or process payments."
      },
      "publication": {
        "release_notes": "Initial release with CVE lookup, exact-version dependency checks, supported-ecosystem discovery, and incremental CVE updates."
      },
      "apps": "./.app.json"
    }
  }
}